| elastic |
Unusual Pkexec Execution |
production |
2026-10-08 |
| elastic |
File Execution Permission Modification Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
Potential Privilege Escalation via Enlightenment |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via a Parent/Child Process Sequence |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via SUID/SGID |
production |
2026-09-18 |
| elastic |
Privilege Escalation via SUID/SGID |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via SUID/SGID Proxy Execution |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Python cap_setuid |
production |
2026-09-18 |
| elastic |
Suspicious SUID Binary Execution |
production |
2026-09-18 |
| elastic |
Suspicious SUID Binary Execution (Auditd Sequence) |
production |
2026-09-18 |
| elastic |
Privilege Escalation via CAP_SETUID/SETGID Capabilities |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Recently Compiled Executable |
production |
2026-09-18 |
| elastic |
UID Elevation from Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
SUID/SGID Bit Set |
production |
2026-09-18 |
| elastic |
SUID/SGUID Enumeration Detected |
production |
2026-09-18 |
| elastic |
Suspicious File Made Executable via Chmod Inside A Container |
production |
2026-09-18 |
| elastic |
System Binary Path File Permission Modification |
production |
2026-09-18 |
| elastic |
Setcap setuid/setgid Capability Set |
production |
2026-09-18 |
| elastic |
Potential Root Effective Shell from Non-Standard Path via Auditd |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via CVE-2023-4911 |
production |
2026-09-18 |
| elastic |
Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via a Suspicious UID Change |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via a Parent Process Sequence |
production |
2026-09-18 |
| splunk |
Linux Usermod Root UID Set |
production |
2026-07-08 |
| splunk |
Linux Dirty Frag Kernel Privilege Escalation |
production |
2026-07-06 |
| splunk |
Linux Common Process For Elevation Control |
production |
2026-05-13 |
| splunk |
Linux Setuid Using Chmod Utility |
production |
2026-05-13 |
| splunk |
Linux Setuid Using Setcap Utility |
production |
2026-05-13 |
| splunk |
Linux Auditd Setuid Using Chmod Utility |
production |
2026-05-13 |
| splunk |
Linux Auditd Setuid Using Setcap Utility |
production |
2026-05-13 |
| sigma |
PwnKit Local Privilege Escalation |
test |
2024-09-11 |
| sigma |
Setuid and Setgid |
test |
2022-10-05 |
| elastic |
Setgid Bit Set via chmod |
deprecated |
2021-03-16 |